package com.lz.thymeleaf.config;



import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .antMatchers("/Ly-admin-Iframe/**","/","/index").permitAll() //不需要保护的资源，可以多个
                    .anyRequest().hasAuthority("Admin")//设置管理员请求路径权限
                .and()
                    .formLogin()
                        .loginPage("/index")
                        .loginProcessingUrl("/mylogin")
                        .defaultSuccessUrl("/admin")//登录成功后地址栏url为/admin
                .and()
                    .csrf().disable();

            //退出登录
            http.logout().logoutUrl("/logout").logoutSuccessUrl("/index");
            //允许页面引用子页面
            http.headers().frameOptions().sameOrigin();
    }
    //使用加密
//        @Bean
//        public PasswordEncoder passwordEncoder(){
//            return new BCryptPasswordEncoder();
//        }
    //不使用加密
        @Bean
        public PasswordEncoder passwordEncoder() {
            return NoOpPasswordEncoder.getInstance();
}
}
